EH-Net

Ethical Hacking Discussions and Related Certifications => Web Applications => Topic started by: Hack_80 on May 29, 2012, 02:09:46 PM



Title: vulnerability :SSL Medium Strength Cipher Suites Supported
Post by: Hack_80 on May 29, 2012, 02:09:46 PM
In my recent scan of Nessus i found most of the system reported with "SSL Medium Strength Cipher Suites Supported". I tried the solutions mentioned in "http://blogs.iis.net/sakyad/archive/2008/12/11/enforcing-ssl-3-0-and-removing-weak-encryption-vulnerability-over-ssl-iis-6-0-and-isa.aspx" but some of the servers are still reported for vulnerability.
Kindly suggest the way out for resolving the same in more than 1000+ server remotely.


Title: Re: vulnerability :SSL Medium Strength Cipher Suites Supported
Post by: Data_Raid on May 29, 2012, 03:34:08 PM
What webservers are running on the other hosts that are reported as vulnerable, are the results for webservers or other devices?
Are all the webservers running IIS?
Are you saying that after following the suggestions on the website above, the servers are still being reported as vulnerable?
What details are reported for the vulnerability in Nessus, is the following message the same: http://www.nessus.org/plugins/index.php?view=single&id=42873 ?


Title: Re: vulnerability :SSL Medium Strength Cipher Suites Supported
Post by: Hack_80 on May 30, 2012, 12:17:15 AM
You got it right Data_Raid....reported vulnerability are on IIS servers.
with the same Nessus Plugins ID.


Title: Re: vulnerability :SSL Medium Strength Cipher Suites Supported
Post by: Data_Raid on May 30, 2012, 04:49:00 AM
You should have a list of ciphers reported as having a key length of 56 bits or 112 bits or less from the Nessus scan, and you could focus on addressing just those ciphers. The following Microsoft KB article describes how to disable the various weak ciphers: http://support.microsoft.com/kb/245030
There are many other references to disabling weak cipher keys on IIS 6, for example: http://www.waynezim.com/2011/03/how-to-disable-weak-ssl-protocols-and-ciphers-in-iis/ which also describes using a tool called SSLScan to test the ciphers easily.

HTH